A New Malware-As-A-Service Platform Emerges, Threatening Windows Enterprises for as Little as $250 per Month
A disturbing trend in cybercrime has taken a dark turn with the discovery of VectraRAT, a comprehensive malware-as-a-service (MaaS) platform designed to compromise enterprise networks on Windows systems. What’s particularly alarming is that this full-stack solution can be acquired by attackers for a mere $250 per month, making it an affordable and accessible tool for even amateur cybercriminals.
VectraRAT boasts a sophisticated suite of features, including a custom-built Windows implant, command-and-control (C2) infrastructure, and an operator panel. This makes it a formidable threat to organizations with Windows-based systems, as it provides attackers with unfettered access to sensitive data and interactive control over compromised machines. The platform’s capabilities are on par with those of more established MaaS solutions, but its custom-built design sets it apart from others in the market.
Researchers at SOCRadar uncovered VectraRAT after observing an open directory that led them to investigate across multiple servers, samples, and panel logs belonging to real operators. During their investigation, they also had a conversation with the platform’s developer, who offered add-on services such as crypting for between $100 and $350 per month. The developer even demonstrated scan results against popular antivirus products, highlighting the platform’s ability to evade detection.
VectraRAT is delivered through Amadey loader and ClickFix pages, which are often used in social engineering campaigns. Once installed, it provides attackers with a range of capabilities, including remote access, keylogging, file transfer, process discovery, clipboard manipulation, and SOCKS5 proxy functionality. The platform also automatically collects browser credentials and searches for sensitive configuration files when a victim first connects to the attacker’s infrastructure.
This level of sophistication and custom-built design raises concerns about the growing accessibility of cybercrime tools. “What really raises the bar here is how full-featured this solution is and how it’s built completely from scratch rather than being a fork from another MaaS solution,” said Denis Calderone, chief technology officer of Suzu Labs. “It’s very sophisticated, does user account control (UAC) bypass, it uses proprietary protocols for C2, and is priced like any midtier software-as-a-service (SaaS) application.”
The emergence of VectraRAT serves as a stark reminder that cybercrime continues to evolve and adapt to the changing threat landscape. As organizations continue to rely on Windows systems, they must remain vigilant against this new threat and take proactive steps to protect their networks.
So what can you do to stay safe? Firstly, ensure that your antivirus software is up-to-date and capable of detecting emerging threats like VectraRAT. Secondly, implement robust network segmentation to limit the damage in case of a breach. Finally, educate your employees on the dangers of social engineering tactics and encourage them to be cautious when interacting with unfamiliar links or attachments. By staying informed and proactive, you can reduce the risk of falling victim to this new malware-as-a-service platform.
Source: Dark Reading — 2026-09-15